Greetings, Hope this is a correct place for these questions. I'm trying to utilize a smart token for various purposes, ultimately I'd like to have a single token for login, encrypting data either with FileVault or specific disk image, and VPN connection. FWIW, I'm using Charismathics CSSI, their tokend and plug'n crypt tokens. We are utilizing Open Directory, but having a lot of mobile users for which I'd like to use portable account (no synchronization). I have run into various problems with these aims and I'm hoping that someone could help with these. 1) I can use sc_auth to bind a token for login to an account. After that, I can also set screen to lock with token removal. However, after screen is locked I cannot use token's PIN anymore for login, only password is accepted even if I plug the token back. 2) tokenadmin create-fv-user fails for creating FileVaulted new account. sudo tokenadmin -v create-fv-user -u tokenuser -l "Token User" gives output: create-fv-user "-u" "tokenuser" "-l" "Token User" Authorizing right system.preferences.accounts Connecting to writeconfig... Connected Validating full name: Token User Validating short name: tokenuser 2010-09-07 13:00:17.908 tokenadmin[42782:e07] failed to convert string tokenadmin: Creating user "Token User" (tokenuser) Creating new user account: tokenuser 2010-09-07 13:00:18.354 tokenadmin[42782:e07] *** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '*** -[NSPlaceholderString initWithString:]: nil argument' *** Call stack at first throw: ( 0 CoreFoundation 0x00007fff85e95cc4 __exceptionPreprocess + 180 1 libobjc.A.dylib 0x00007fff85aa90f3 objc_exception_throw + 45 2 CoreFoundation 0x00007fff85e95ae7 +[NSException raise:format:arguments:] + 103 3 CoreFoundation 0x00007fff85e95a74 +[NSException raise:format:] + 148 4 Foundation 0x00007fff81819aaa -[NSPlaceholderString initWithString:] + 102 5 Foundation 0x00007fff81835e01 +[NSString stringWithString:] + 45 6 Admin 0x00007fff865d8274 -[User setPassword:] + 79 7 tokenadmin 0x0000000100001774 0x0 + 4294973300 8 tokenadmin 0x0000000100001085 0x0 + 4294971525 9 tokenadmin 0x0000000100000c8c 0x0 + 4294970508 ) terminate called after throwing an instance of 'NSException' Abort trap bash-3.2$ 2010-09-07 13:00:20.419 writeconfig[42783:903] writeconfig quitting because of exception:connection went invalid while waiting for a reply If I add -p, for optional password, a different error, this time account is created but creating sparsebundle fails: create-fv-user "-u" "tokenuser" "-l" "Token User" "-p" "tokenuser" Authorizing right system.preferences.accounts Connecting to writeconfig... Connected Validating full name: Token User Validating short name: tokenuser tokenadmin: Creating user "Token User" (tokenuser) Creating new user account: tokenuser Creating home directory... 2010-09-07 13:02:35.890 writeconfig[42815:903] DIHLFVMount failed with 80 tokenadmin: Failed to create home directory New user account created and configured 2) I could do without FileVault if I could create an encrypted image bound to token certificate. However, I haven't found an option to do this. hdiutil can create an encrypted container with path to a certificate as an argument. However, it doesn't understand a reference to a keychain that is a token. Any suggestions to overcome this? Thank you in advance for any replies, Juha Ratilainen